Migrate ci-tools to Lua 5.4 and eliminate kernel-header CVEs#189
Merged
Conversation
lex57ukr
added
enhancement
Compile luacheck/busted for Lua 5.4 in a throwaway builder stage and copy only the runtime plus rock trees into the final image. This drops luarocks, gcc, and the liblua-dev -> libc6-dev -> linux-libc-dev header chain from the final image, eliminating 79 linux-libc-dev CVEs (incl. one critical) at the source rather than suppressing them. busted now runs on Lua 5.4 to match Pandoc's embedded HsLua runtime. Suppress jq CVE-2026-32316 and CVE-2026-40164 (deb12u2 fix not yet in the Debian mirror) and advertise luassert plus the Lua 5.4 interpreter.
lex57ukr
force-pushed
the
187-cve-ci-tools-jq-tool-refresh
branch
from
July 6, 2026 02:02
1233f73 to
d9bb91b
Compare
lex57ukr
enabled auto-merge (squash)
July 6, 2026 02:02
This was referenced Jul 6, 2026
lex57ukr
added a commit
that referenced
this pull request
Jul 6, 2026
The 5.4 rebuild (#189) moved luarocks and gcc to the throwaway builder stage. zip and unzip had only ever been present as transitive apt deps of luarocks in the final image, so they silently dropped out. Both are part of the tool contract downstream bats suites depend on to assemble and inspect archive-format fixtures (ODT/DOCX/EPUB); their absence surfaces as `zip: command not found` (status 127). Request them explicitly so a future dependency shuffle can't drop them again, assert them in verify.sh, and list them in the README tool inventory.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The scheduled CVE monitor (#187) flagged fixable HIGH/CRITICAL vulnerabilities in ci-tools, and separately keystone needs busted to run on Lua 5.4 to match Pandoc's embedded HsLua runtime (#188). These share a mechanism: the bulk of the CVEs — 79 in
linux-libc-dev(kernel headers), including one critical — are dragged into the image transitively by luarocks'-devdependency chain, and can't be purged without breaking the installed rocks. Rebuilding the lua toolchain for 5.4 via a multi-stage build compiles the rocks in a throwaway builder and ships only the runtime, eliminating those 79 CVEs at the source instead of suppressing them.Related Issues
Fixes #187
Fixes #188
Changes
builderstage compiles luacheck + busted for Lua 5.4; the final stage installs only thelua5.4runtime and copies the compiled rock trees, dropping luarocks, gcc, and theliblua-dev → libc6-dev → linux-libc-devheader chain — removing 79linux-libc-devCVEs (incl. the critical) from the image entirely.CVE-2026-32316andCVE-2026-40164(Debian deb12u2 fix not yet in the mirror), tracked under Update actionlint and shfmt to remove suppressed Go stdlib CVEs #96.make resolve(markdownlint-cli2 0.23.0, biome 2.5.2).Further Comments
Verified locally:
make scanexits clean (0 vulns on the debian target),make verifyreports Lua 5.4.4 with all tools OK, and the full 217-test bats suite passes. Confirmed the final image ships nolinux-libc-dev,libc6-dev,gcc, orluarocks.